\documentclass{beamer}
\usepackage{url}
\usepackage{xspace}
\usepackage{graphicx}
\usepackage{beamerthemesplit}
%\usefonttheme[onlysmall]{structurebold}
%\usefonttheme[stillsansseriflarge,stillsansserifsmall]{serif}
%\setbeamerfont{subsection in toc}{family=\sffamily}
\setbeamertemplate{navigation symbols}{} % Get rid of stupid nav symbols
%\usepackage{fontspec}
%\defaultfontfeatures{Mapping=tex-text,Numbers=OldStyle}
%\setromanfont{Minion Pro}
%\setsansfont{Myriad Pro}

\newcommand{\AND}{\&\xspace}

\author{Charlie Moore \AND Aaron Lovato}
\title[FReeConf]{FReeConf: Implementing RBAC in FreeRADIUS}
\date{May 3, 2010}
\institute[NMT]{New Mexico Tech}

\begin{document}
\section{Introduction}
\frame{\titlepage}
\frame{\tableofcontents}

% Motivation and problem statement
\begin{frame}{Problem Statement}
  \begin{itemize}
  \item RBAC is desirable for companies to use
  \item No standard way to implement RBAC across an enterprise
  \item FreeRADIUS is a production quality implementation of RADIUS
  \begin{itemize}
      \item The most widely used in the world~\cite{freerad}
  \end{itemize}
  \item RADIUS is used by large companies for authentication, authorization, and
    accounting
  \end{itemize}
\end{frame}


\section{Background}
% Technical Background / Related Work
\begin{frame} {RADIUS}
\begin{itemize}
    \item Protocol for AAA
    \item RFCs 2865, 2866
    \item Clients request access, server authenticates user and replies with
    configuration values
    \begin{itemize}
        \item Because ALL values are returned, this doesn't enforce least
        privilege
    \end{itemize}
\end{itemize}
\end{frame}

\begin{frame} {FreeRADIUS}
\begin{itemize}
    \item Remote Authentication Dial In User Service
    \item An implementation of the RADIUS protocol
    \item Supports many authentication protocols
    \item Massive set of hierarchical configuration files
    \item Manual editing required
    \item No roles, no RBAC
\end{itemize}
\end{frame}

\begin{frame} {RBAC}
\begin{itemize}
    \item Covered in class
    \item Powerful way to conceptualize Access Control
    \item We implemented level 2a in the NIST paper (general hierarchical)
    \item Project could be extended to implement level 3
\end{itemize}
\end{frame}

\section{Approach}
% Design and Implementation
\begin{frame} {FReeConf}
\begin{itemize}
    \item An application to configure FreeRADIUS to reflect an RBAC
    configuration
    \item Manages the configuration files on a FreeRADIUS server
    \item Can verify the configuration files to ensure they have not changed
    \item Support for a general hierarchy
    \item Semi-cross platform
    \begin{itemize}
        \item Would require integration with a secure access system
    \end{itemize}
    \item Two distinct parts: backend and GUI
\end{itemize}
\end{frame}

\begin{frame} {Backend---Modeling RBAC Concepts}
  \begin{itemize}
  \item User
    \begin{itemize}
    \item Provides entensibility to more sophisticated authentication schemes
        \item Contains list of roles to simplify configuration output
    \end{itemize}
  \item Permission
    \begin{itemize}
    \item Maps object to action
    \end{itemize}
  \item Role
    \begin{itemize}
    \item Maintains user assignments and permission assignments
    \item Supports a hierarchy
    \item Multiple parents and multiple children
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}{Backend---Server}
  \begin{itemize}
  \item Maintains list of roles and users on a FreeRADIUS server
  \item Provides API to modify these lists
  \item Contains configuration necessary to access server
  \item Handles configuration management
    \begin{itemize}
    \item Push configuration
    \item Pull and verify configuration
    \end{itemize}
  \item Converts RBAC data to something FreeRADIUS can understand...
  \item Serializes state into an XML file
  \end{itemize}
\end{frame}

\begin{frame}{FreeRADIUS, How Does It Work?}
\begin{itemize}
    \item Users file
    \begin{itemize}
        \item Associates user with requirements and configuration
        \item Requirements = password
        \item Configuration = permissions
        \item Some restrictions
    \end{itemize}
    \item Dictionary files
    \begin{itemize}
        \item Associate attribute names with types
        \item For convenience, we use strings for all types
        \item Because the attributes are defined by the RFC, we took advantage
        of the Vendor-Specific attribute type
    \end{itemize}
    \item No way to implement sessions
\end{itemize}
\end{frame}

\begin{frame} {Creating the Configuration}
\begin{itemize}
    \item Remember the users file and dictionary files?
    \item Association of roles with each user simplifies life here
    \begin{itemize}
        \item For each role, write permissions from role
        \item Recursively walk up list of parents to get all permissions
    \end{itemize}
    \item Brute-force entries into dictionary file
    \item Use SSH to push files to server
    \begin{itemize}
        \item User still needs to restart radiusd
        \item This is a hack
    \end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{GUI Requirements}
  \begin{itemize}
  \item View the permissions attached to a role
  \item View all users assigned to a role
  \item View the general hierarchy of roles
  \item View all roles assigned to a user
  \end{itemize}
\end{frame}

\begin{frame}{GUI}
  \begin{itemize}
  \item Roles \AND Users tabs
  \item Inverted tree for roles
  \item Duplicate subtree when multiple nodes have same parent
    \begin{center}
      \includegraphics[height=1.5in]{diamond}
    \end{center}
  \item Use traditional metaphors to keep actions intuitive 
  \end{itemize}
\end{frame}

\section{Results}
% What we came up with
\begin{frame}{DEMO}
  \begin{center}
    \LARGE Demo time!
  \end{center}
\end{frame}


\section{Conclusion}
\begin{frame}{Limitations}
  \begin{itemize}
    \item This functionality should be integrated with a full-featured
      FreeRADIUS configuration manager (or it could be extended to do that)
    \item Can't log into client configurations without extra management
    \item No least privilege
    \item No way to implement sessions
  \end{itemize}
\end{frame}

\begin{frame}{Conclusion}
\begin{itemize}
    \item FReeConf provides user-friendly way to configure FreeRADIUS to support
    RBAC
    \item FreeRADIUS has some quirks that restrict the implementation
    \begin{itemize}
        \item No least privilege
        \item No sessions
    \end{itemize}
    \item Actually implementing the hierarchy vastly improved our understanding
    of RBAC
    \item Getting bogged down in implementation slowed us down a lot
\end{itemize}
\end{frame}
% Lessons learned or some shit

\begin{frame}{Conclusion}
  \begin{center}
    \LARGE Discussion / Questions?
  \end{center}
\end{frame}

%% \begin{frame}
%%   \begin{center}
%%     \includegraphics[width=2in]{rage.png}
%%   \end{center}
%% \end{frame}

\begin{frame}[allowframebreaks]{References}
  \nocite{*}
  \bibliographystyle{plain}
  \bibliography{refs}
\end{frame}

\end{document}
